On Wed, Aug 27, 2025 at 08:19:51PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Aug 27, 2025 at 07:12:36PM +0200, Florian Westphal wrote:
> > Hi,
> >
> > as subject says, 'nft monitor -j' is broken.
> > Example:
> >
> > ./run-tests.sh -j testcases/object.t
> > monitor: running tests from file object.t
> > monitor output differs!
> > --- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk 2025-08-27 19:05:08.039619097 +0200
> > +++ /tmp/tmp.emU4zIN8UT/tmp.jBOL3aIrp5 2025-08-27 19:05:09.062551248 +0200
> > @@ -1 +1 @@
> > -{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 26214400, "used": 0, "inv": false}}}
> > +{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 0, "used": 0, "inv": false}}}
> > monitor output differs!
> > --- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk 2025-08-27 19:05:10.095619097 +0200
> > +++ /tmp/tmp.emU4zIN8UT/tmp.Guz55knY19 2025-08-27 19:05:11.117393075 +0200
> > @@ -1 +1 @@
> > -{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 1, "per": "second", "burst": 5}}}
> > +{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 0, "per": "error"}}}
> >
> > I did notice this weeks ago but thought it was a problem on my end
> > and then didn't have time to investigate closer.
> >
> > But its in fact broken on kernel side, since
> >
> > netfilter: nf_tables: Reintroduce shortened deletion notifications
> >
> > In short, unlike the normal output, json output wants to dump
> > everything, but the notifications no longer include the extra data, just
> > the bare minimum to identify the object being deleted.
> >
> > As noone has complained so far I am inclinded to delete the
> > tests and rip out json support from monitor mode, it seems noone
> > uses it or even runs the tests for it.
>
> Why? Is unfixable to consider this?
>
> > Alternatives i see are:
> > 1. implement a cache and query it
>
> There is a cache infrastructure, monitor only need to use it.
"monitor only use it"
Addendum:
this is a relatively large rework, I started some code but is
incomplete, including rule caching to deal with runtime incremental
updates.
I think it should be better to fix what we have then look pick back on
the rework at some point.
> > 2. rework the json mode to be forgiving as to what is set
> > and what isn't in the object.
> >
> > Object here also means any object reported in any delete kind,
> > not just NFT_MSG_DELOBJ. This applies to set elements etc. too,
> > json expects the full info, but the kernel notifications no longer
> > provide this.
>
> But it does not make sense to provide the full information, delete
> object should just provide the handle to identify, to remain in parity
> with the native syntax.
>
> > Alternative options?
>
